Asterisk Project Security Advisory - AST-2017-014
Product Asterisk
Summary Crash in PJSIP resource when missing a contact
header
Nature of Advisory Remote Crash
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On December 12, 2017
Reported By Ross Beer
Posted On
Last Updated On December 22, 2017
Advisory Contact Kevin Harwell
CVE Name
Description A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For those
messages, if the header was not present and using the PJSIP
channel driver, it would cause Asterisk to crash. The
severity of this vulnerability is somewhat mitigated if
authentication is enabled. If authentication is enabled a
user would have to first be authorized before reaching the
crash point.
Resolution When using the Asterisk PJSIP resource, and one of the SIP
messages that create a dialog is received Asterisk now
checks to see if the message contains a contact header. If
it does not Asterisk now responds with a "400 Missing
Contact header".
Affected Versions
Product Release
Series
Asterisk Open Source 13.x All versions
Asterisk Open Source 14.x All versions
Asterisk Open Source 15.x All versions
Certified Asterisk 13.18 All versions
Corrected In
Product Release
Asterisk Open Source 13.18.5, 14.7.5, 15.1.5
Certified Asterisk 13.18-cert2
Patches
SVN URL Revision
http://downloads.asterisk.org/pub/security/AST-2017-014-13.diff Asterisk
13
http://downloads.asterisk.org/pub/security/AST-2017-014-14.diff Asterisk
14
http://downloads.asterisk.org/pub/security/AST-2017-014-15.diff Asterisk
15
http://downloads.asterisk.org/pub/security/AST-2017-014-13.18.diff Certified
Asterisk
13.18
Links https://issues.asterisk.org/jira/browse/ASTERISK-27480
Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security
This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2017-014.pdf and
http://downloads.digium.com/pub/security/AST-2017-014.html
Revision History
Date Editor Revisions Made
December 20, 2017 Kevin Harwell Initial Revision
Asterisk Project Security Advisory - AST-2017-014
Copyright (c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

The Asterisk Development Team has announced security releases for Certified Asterisk 13.13 and Asterisk 13, 14 and 15. The available security releases are released as versions 13.13-cert9, 13.18.4, 14.7.4 and 15.1.4.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of these versions resolves the following security vulnerabilities:

* AST-2017-012: Remote Crash Vulnerability in RTCP Stack
If a compound RTCP packet is received containing more than one report (for example a Receiver Report and a Sender Report) the RTCP stack will incorrectly store report information outside of allocated memory potentially causing a crash.

For a full list of changes in the current releases, please see the ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.4
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.4
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.4
http://downloads.asterisk.org/pub/telephony/certified-asterisk/ChangeLog-certified-13.13-cert9

The security advisories are available at:
http://downloads.asterisk.org/pub/security/AST-2017-012.html
http://downloads.asterisk.org/pub/security/AST-2017-012.pdf

The Asterisk Development Team has announced security releases for
Certified Asterisk 13.13 and Asterisk 13, 14 and 15. The available
security releases are released as versions 13.13-cert8, 13.18.3,
14.7.3 and 15.1.3.
These releases are available for immediate download at
http://downloads.asterisk.org/pub/telephony/asterisk/releases
The release of these versions resolves the following security
vulnerabilities:
* AST-2017-013: DOS Vulnerability in Asterisk chan_skinny
If the chan_skinny (AKA SCCP protocol) channel driver is
flooded with certain requests it can cause the asterisk
process to use excessive amounts of virtual memory
eventually causing asterisk to stop processing requests of
any kind.
For a full list of changes in the current releases, please see the
ChangeLogs:
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.18.3
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog=14.7.3
http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.1.3
http://downloads.asterisk.org/pub/telephony/certified-asterisk/ChangeLog-certified-13.13-cert8
The security advisories are available at:
http://downloads.asterisk.org/pub/security/AST-2017-013.pdf

The Asterisk Development Team has announced security releases for Certified Asterisk 13.13 and Asterisk 13, 14 and 15. The available security releases are released as versions 13.13-cert8, 13.18.3, 14.7.3 and 15.1.3.

These releases are available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases

The release of these versions resolves the following security vulnerabilities:

* AST-2017-013: DOS Vulnerability in Asterisk chan_skinny
If the chan_skinny (AKA SCCP protocol) channel driver is flooded with certain requests it can cause the asterisk process to use excessive amounts of virtual memory eventually causing sterisk
to stop processing requests of any kind.